CVE-2016-8581

This exploit demonstrates a stored XSS vulnerability in Alienvault OSSIM/USM <=5.3.1, where malicious JavaScript injected via the User-Agent header executes when mousing over the User-Agent field in the 'Current Sessions' page. The PoC sends session IDs to an arbitrary site (Google in this example).

This Metasploit module exploits an unauthenticated SQL injection vulnerability in AlienVault OSSIM to retrieve an admin session ID, then leverages it to execute arbitrary commands via policy creation. The exploit chain involves SQLi for session hijacking followed by RCE through policy manipulation.